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Amendments to the Abstract: 

6. On page 48, replace lines 3-12 to read in full as follows: 

ABSTRACT OF THE DISCLOSURE 

An exemplary embodiment of the present invention includes a method to enforce privacy 
preferences on exchanges of personal data of a data- subject. The method comprises the steps of: 
specifying data-subject authorization rule sets having subject constraints, receiving a request 
message from a requester and a requester privacy statement, comparing the requester privacy 
statement to the subject constraints, and releasing the data-subject data in a response message to 
the requester only if the subject constraints are satisfied. The requester privacy statement includes 
purpose, retention, recipient, and access information, wherein the purpose information specifies 
the purpose for which the requested data is acquired, the retention information specifies a 
retention policy for the requested data, the recipient information specifies the recipients of the 
. requested* data, and* the- access information specifies whether the requested data should be 
accessible to the data-subject after the data has been released. 


